O365 / Azure AD - two accounts for admins v. PIM

[madcat]

I refer to this existing post which neatly sums up my query: https://techcommunity.microsoft.com/t5/admin-center/admin-roles-for-user-accounts-vs-separate-admin-...

Basically is it a good idea with O365 admins to have a regular daily use account separate from the admin account and then only use the admin account as required in an incognito browser window and sign out when finished (MFA on all accounts regardless a given)?

Benefits I see:

• minimises risk of being struck by virus or malware while logged into admin account
• mitigates risk of admin user accidentally changing office 365 admin settings / azure ad tenant config
• ensure any content created by admin user is owned by their regular user account

I didn't think the admin account would need to be assigned an O365 licence but then I realised it would have no mailbox associated with it so how would it get admin alerts?

@Vasil Michev suggests Privileged Identity Management (PIM) is a better solution to this in the original post but that would more than double our monthly user cost as it requires Azure AD P2 and we are just using O365 Essentials with Azure AD basic right now.

So assuming PIM is not in our is having two accounts a good idea and if so does the admin account actually need an O365 licence to be able to receive email alerts?

[#2]

You only need the Azure AD license for your admin(s), plus it adds some other goodness such as Conditional access policies, Azure AD identity protection and so on.

To your question, no, generally you don't need to have a license or a mailbox for the admin, there are very few functionalities that will not work without one. Alerts will be sent to the "alternative address" you specify when assigning an admin role.

[#3]

@Vasil Michev Ahh wait I first read this message at about 3:30am Sunday morning - are you saying only the admin needs an AD Premium subscription to unlock all that stuff - not every user?

[#4]

Define "all that stuff"? What I'm saying it that for PIM, you need only licenses for the admins. The other features will have varied license requirements, check the documentation.